CVE-2026-54000
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In osquery prior to version 5.23.1 on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write when querying the processes table for a maliciously crafted process. The vulnerability is due to unchecked PEB string lengths in process command-line and current-directory reads.
Risk Assessment
Successful exploitation could allow local privilege escalation from a standard user to SYSTEM, giving the attacker full control over the system.
Recommendation
Immediately upgrade osquery to version 5.23.1 or later, which contains the fix for this vulnerability.
Other vulnerabilities in osquery
See all- CVE-2026-54001High
On Windows, prior to version 5.23.1, a local unprivileged attacker can trigger a heap buffer out-of-bounds write when querying the authenticode table against a maliciously crafted binary. The vulnerability stems from publisher information parsing in the getOriginalProgramName function.
- CVE-2026-46388Medium
In osquery prior to version 5.23.1, an unprivileged attacker can read the contents of files during an ongoing file carve because temporary directories are not created with private permissions. If the carve targets a directory controlled by the attacker, arbitrary file reads are possible, including sensitive local files.
Original NVD description (English source)
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write if there is a query of the processes table targeting a maliciously crafted process, due to unchecked PEB string lengths in process command-line and current-directory reads. If exploited successfully, this could allow a potential local privilege escalation from standard user to SYSTEM. This issue is fixed in version 5.23.1.